Data Processing Addendum

This addendum is between BackMyTown Ltd, registered in England and Wales (company number 17360461, registered office 10 Beaufort Close, Reigate, RH2 9DG, United Kingdom) ("we", "us"), and the club, class or activity provider that accepts it on its BackMyTown dashboard ("you"). It supplements the BackMyTown Vendor Agreement and applies only to class sign-up details. It is the written contract Article 28(3) of the UK GDPR requires.

You must accept it before your classes can ask parents for anything. Until you do, no parent is asked for any detail about a child when buying a place from you.

1. Roles

For class sign-up details, you are the controller and we are your processor. We collect them on your behalf, for your purpose (enrolling a child in your class and keeping them safe there), and we have no purpose of our own for them.

For everything else about a purchase (the parent's account, the order, the payment, our tax records, receipts and message preferences) we are a controller in our own right, as the Vendor Agreement and our Privacy Policy describe. This addendum does not change that.

2. Subject matter, nature, purpose and duration

3. Data subjects and types of personal data

Data subjects: the children who are given places in your classes, their parents or carers who buy the places, and the person the parent names as an emergency contact.

Personal data, limited to what you choose from this fixed list on your dashboard, and nothing else:

• the child's full name (always collected for a class place);
• the child's date of birth;
• anything the parent chooses to tell you about allergies, medical or additional needs, in one optional box (special category data, health);
• the parent's full name, phone number and home address;
• an emergency contact telephone number;
• which session of the class the child will attend.

We do not let you add other questions, and we refuse any detail you have not chosen.

4. Your instructions

Your documented instructions to us are:

1. collect only the items you have ticked on your dashboard, at checkout, for a place in one of your classes;
2. show them to you on your dashboard and let you download them; and
3. delete them on the timetable in section 5.

Ticking or unticking an item is an instruction, and takes effect for the next sign-up. We tell you if we think an instruction infringes data protection law. We process the details on no other instruction, unless the law requires us to, in which case we tell you first unless the law forbids it.

5. Deletion

We delete each sign-up's details (the order record itself is kept, as our tax record):

• 30 days after the last day of the term the place was for;
• 90 days after purchase, for a place that is not a term;
• one day after an unpaid checkout lapses; and
• straight away if the parent's account is erased.

When this addendum ends, we delete every sign-up's details we hold for you within 30 days. Download anything you need before then. What you have downloaded is yours to protect and delete.

6. Confidentiality and security

Only the people who run the platform for us can reach the details, they are bound by confidentiality, and they reach them only to keep the service running or when the law requires it. We keep them secure, including:

• the medical or additional needs box is encrypted in our database under a key kept in a managed key vault, separately from the data, and our whole database is encrypted at rest;
• the details are shown only on your own signed-in dashboard, never on any public page or to any other business or town;
• they are never sent by email and never written to our logs: the email telling you about a sign-up says only how many children signed up; and
• every connection is encrypted in transit.

7. Sub-processors

You authorise these sub-processors for class sign-up details:

The class sign-up details never reach our email provider (Brevo), our payment processor (Stripe) or our error-monitoring service (Sentry): we send none of them there. We will tell you at least 30 days before we add or replace a sub-processor for these details, and you may object; if we cannot meet the objection, you may stop using class sign-ups and end this addendum. Each sub-processor is bound by terms that protect the data at least as well as this addendum.

We do not transfer the details outside the UK. If that ever changes, we will use a lawful transfer mechanism and tell you first.

8. Helping you

Taking into account what we can see, we will:

• help you answer a parent's request to see, correct or delete their or their child's details, by passing any request we receive to you without delay and by correcting or deleting details on your instruction;
• tell you without undue delay, and within 48 hours, after we become aware of a personal data breach affecting the details, with what we know;
• give you the information you reasonably need for your own data protection impact assessment: our own assessment of this processing is available from privacy@backmytown.com; and
• help you with any consultation with the Information Commissioner.

9. Records and audit

We will make available the information you need to show that we meet this addendum, and allow for and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice, once a year unless a breach or a regulator requires otherwise.

10. Your side

You confirm you have a lawful basis for the details you ask for, including a condition for health information, and that you will use the details only to enrol the child and keep them safe in your class, keep them secure, and delete them when the child stops attending.

11. General

This addendum is governed by the law of England and Wales. If it conflicts with the Vendor Agreement about class sign-up details, this addendum wins. We may publish a new version; you will be asked to accept it on your dashboard, and until you do, your classes will not ask parents for anything.

Questions: privacy@backmytown.com.